Monitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | WinEventLog:Sysmon | EventCode=10 |
| File Access (DC0055) | WinEventLog:Security | EventCode=4656 |
| Service Creation (DC0060) | WinEventLog:System | EventCode=7045 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Sysmon | EventCode=13 |
| Field | Description |
|---|---|
| TargetImage | Scope to sensitive GUI/session processes like winlogon.exe or osk.exe |
| AccessMask | Can be tuned to 0x1fffff for full-access injection detection |
| TimeWindow | Tunable for sustained polling or multiple registry edits in short succession |
Detects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | open, read |
| OS API Execution (DC0021) | auditd:SYSCALL | ptrace, ioctl |
| Field | Description |
|---|---|
| ProcessName | Exclude known good applications (e.g. Xorg, GNOME Shell) |
| DevicePath | Typically /dev/input/event*, but tunable to match custom input buses |
Detects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | macos:unifiedlog | subsystem=com.apple.TCC |
| Process Creation (DC0032) | macos:osquery | process_events OR launchd |
| Field | Description |
|---|---|
| Service | com.apple.inputmonitoring, com.apple.accessibility, etc. |
| ExecutablePath | Tunable to exclude trusted endpoint monitoring tools |
Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.
| Data Component | Name | Channel |
|---|---|---|
| Firmware Modification (DC0004) | networkdevice:syslog | Image Upgrade / Configuration Change |
| Network Traffic Content (DC0085) | NSM:Flow | packet capture or DPI logs |
| Field | Description |
|---|---|
| FirmwareVersion | Baseline hash or expected version for config/image integrity |
| Protocol | Scope to plaintext channels or low-assurance SSH versions |